Skip to content

Commit 27d9db5

Browse files
stevegrubbstevegrubb
authored
Merge pull request #464 from stevegrubb/auparse
Make auparse muti-thread safe
2 parents fb22301 + 4cf30b0 commit 27d9db5

17 files changed

+326
-201
lines changed

‎auparse/auparse-idata.h‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
#include "config.h"
2828
#include "dso.h"
29+
#include "auparse.h"
2930
#include "auparse-defs.h"
3031

3132
typedef struct _idata {
@@ -38,14 +39,16 @@ typedef struct _idata {
3839
const char *val; // value of field being interpreted
3940
} idata;
4041

42+
#define NEVER_LOADED 0xFFFF
4143

4244
int auparse_interp_adjust_type(int rtype, const char *name, const char *val);
43-
char *auparse_do_interpretation(int type, const idata *id,
44-
auparse_esc_t escape_mode);
45-
void _auparse_load_interpretations(const char *buf);
46-
void _auparse_free_interpretations(void);
47-
const char *_auparse_lookup_interpretation(const char *name);
48-
void _auparse_flush_caches(void);
45+
char *auparse_do_interpretation(auparse_state_t *au, int type, const idata *id,
46+
auparse_esc_t escape_mode);
47+
void _auparse_load_interpretations(auparse_state_t *au, const char *buf);
48+
void _auparse_free_interpretations(auparse_state_t *au);
49+
const char *_auparse_lookup_interpretation(auparse_state_t *au,
50+
const char *name) __attribute_malloc__ __attr_dealloc_free;
51+
void _auparse_flush_caches(auparse_state_t *au);
4952

5053
#endif
5154

‎auparse/auparse.c‎

Lines changed: 45 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,19 @@
2222
*/
2323

2424
#include "config.h"
25-
#include "expression.h"
26-
#include "internal.h"
27-
#include "auparse.h"
28-
#include "interpret.h"
29-
#include "auparse-idata.h"
30-
#include "libaudit.h"
3125
#include <errno.h>
3226
#include <stdlib.h>
3327
#include <string.h>
3428
#include <unistd.h>
3529
#include <fcntl.h>
3630
#include <stdio_ext.h>
3731
#include <limits.h>
32+
#include "internal.h"
33+
#include "expression.h"
34+
#include "auparse.h"
35+
#include "interpret.h"
36+
#include "auparse-idata.h"
37+
#include "libaudit.h"
3838
#include "common.h"
3939

4040
//#define LOL_EVENTS_DEBUG01 1 // add debug for list of list event
@@ -46,12 +46,6 @@ static int debug = 0;
4646

4747
static time_t eoe_timeout = EOE_TIMEOUT;
4848

49-
static void init_lib(void) __attribute__ ((constructor));
50-
static void init_lib(void)
51-
{
52-
init_interpretation_list();
53-
}
54-
5549
/* like strchr except string is delimited by length, not null byte */
5650
static char *strnchr(const char *s, int c, size_t n)
5751
{
@@ -574,6 +568,11 @@ auparse_state_t *auparse_init(ausource_t source, const void *b)
574568
au->find_field = NULL;
575569
au->search_where = AUSEARCH_STOP_EVENT;
576570
au->tmp_translation = NULL;
571+
au->uid_cache = NULL;
572+
au->uid_cache_created = 0;
573+
au->gid_cache = NULL;
574+
au->gid_cache_created = 0;
575+
init_interpretation_list(au);
577576
init_normalizer(&au->norm_data);
578577

579578
return au;
@@ -633,8 +632,8 @@ static void consume_feed(auparse_state_t *au, int flush)
633632
au->le = l; // make this current the event of interest
634633
aup_list_first(l);
635634
r = aup_list_get_cur(l);
636-
free_interpretation_list();
637-
load_interpretation_list(r->interp);
635+
free_interpretation_list(au);
636+
load_interpretation_list(au, r->interp);
638637
aup_list_first_field(l);
639638

640639
if (au->callback) {
@@ -722,22 +721,22 @@ void auparse_set_escape_mode(auparse_state_t *au, auparse_esc_t mode)
722721
* buf is a string of name value pairs to be used for interpreting.
723722
* Calling this function automatically releases the previous list.
724723
*/
725-
void _auparse_load_interpretations(const char *buf)
724+
void _auparse_load_interpretations(auparse_state_t *au, const char *buf)
726725
{
727-
free_interpretation_list();
726+
free_interpretation_list(au);
728727

729728
if (buf == NULL)
730729
return;
731730

732-
load_interpretation_list(buf);
731+
load_interpretation_list(au, buf);
733732
}
734733

735734
/*
736735
* Non-public function. Subject to change.
737736
*/
738-
void _auparse_free_interpretations(void)
737+
void _auparse_free_interpretations(auparse_state_t *au)
739738
{
740-
free_interpretation_list();
739+
free_interpretation_list(au);
741740
}
742741

743742
int auparse_reset(auparse_state_t *au)
@@ -782,7 +781,7 @@ int auparse_reset(auparse_state_t *au)
782781
default:
783782
return -1;
784783
}
785-
free_interpretation_list();
784+
free_interpretation_list((auparse_state_t *)au);
786785
return 0;
787786
}
788787

@@ -791,7 +790,7 @@ char *auparse_metrics(const auparse_state_t *au)
791790
char *metrics;
792791
unsigned int uid, gid;
793792

794-
aulookup_metrics(&uid, &gid);
793+
aulookup_metrics(au, &uid, &gid);
795794

796795
if (asprintf(&metrics,
797796
"max lol available: %lu\n"
@@ -1038,7 +1037,7 @@ static void auparse_destroy_common(auparse_state_t *au)
10381037
fclose(au->in);
10391038
au->in = NULL;
10401039
}
1041-
free_interpretation_list();
1040+
free_interpretation_list(au);
10421041
clear_normalizer(&au->norm_data);
10431042
au_lol_clear(au->au_lo, 0);
10441043
free((void *)au->tmp_translation);
@@ -1048,8 +1047,8 @@ static void auparse_destroy_common(auparse_state_t *au)
10481047

10491048
void auparse_destroy(auparse_state_t *au)
10501049
{
1051-
_aulookup_destroy_uid_list();
1052-
aulookup_destroy_gid_list();
1050+
_aulookup_destroy_uid_list(au);
1051+
aulookup_destroy_gid_list(au);
10531052

10541053
auparse_destroy_common(au);
10551054
}
@@ -1551,8 +1550,8 @@ static int au_auparse_next_event(auparse_state_t *au)
15511550

15521551
aup_list_first(l);
15531552
r = aup_list_get_cur(l);
1554-
free_interpretation_list();
1555-
load_interpretation_list(r->interp);
1553+
free_interpretation_list(au);
1554+
load_interpretation_list(au, r->interp);
15561555
aup_list_first_field(l);
15571556
au->le = l;
15581557
#ifdef LOL_EVENTS_DEBUG01
@@ -1603,8 +1602,8 @@ static int au_auparse_next_event(auparse_state_t *au)
16031602

16041603
aup_list_first(l);
16051604
r = aup_list_get_cur(l);
1606-
free_interpretation_list();
1607-
load_interpretation_list(r->interp);
1605+
free_interpretation_list(au);
1606+
load_interpretation_list(au, r->interp);
16081607
aup_list_first_field(l);
16091608
au->le = l;
16101609
#ifdef LOL_EVENTS_DEBUG01
@@ -1707,8 +1706,8 @@ static int au_auparse_next_event(auparse_state_t *au)
17071706

17081707
aup_list_first(l);
17091708
r = aup_list_get_cur(l);
1710-
free_interpretation_list();
1711-
load_interpretation_list(r->interp);
1709+
free_interpretation_list(au);
1710+
load_interpretation_list(au, r->interp);
17121711
aup_list_first_field(l);
17131712
au->le = l;
17141713
#ifdef LOL_EVENTS_DEBUG01
@@ -1842,7 +1841,7 @@ int auparse_first_record(auparse_state_t *au)
18421841
return rc;
18431842
}
18441843
r = aup_list_get_cur(au->le);
1845-
if (r && r->item == 0 && interpretation_list_cnt()) {
1844+
if (r && r->item == 0 && interpretation_list_cnt(au)) {
18461845
// If we are on the first record and the list has previously
18471846
// been loaded, just pull cursor back and avoid loading the
18481847
// interpretation list.
@@ -1851,8 +1850,8 @@ int auparse_first_record(auparse_state_t *au)
18511850
}
18521851
aup_list_first(au->le);
18531852
r = aup_list_get_cur(au->le);
1854-
free_interpretation_list();
1855-
load_interpretation_list(r->interp);
1853+
free_interpretation_list(au);
1854+
load_interpretation_list(au, r->interp);
18561855
aup_list_first_field(au->le);
18571856

18581857
return 1;
@@ -1867,7 +1866,7 @@ int auparse_next_record(auparse_state_t *au)
18671866
{
18681867
rnode *r;
18691868

1870-
free_interpretation_list();
1869+
free_interpretation_list(au);
18711870
// Its OK if au->le == NULL because get_cnt handles it
18721871
if (aup_list_get_cnt(au->le) == 0) {
18731872
int rc = auparse_first_record(au);
@@ -1876,19 +1875,19 @@ int auparse_next_record(auparse_state_t *au)
18761875
}
18771876
r = aup_list_next(au->le);
18781877
if (r) {
1879-
load_interpretation_list(r->interp);
1878+
load_interpretation_list(au, r->interp);
18801879
return 1;
18811880
} else
18821881
return 0;
18831882
}
18841883

18851884

1886-
int auparse_goto_record_num(const auparse_state_t *au, unsigned int num)
1885+
int auparse_goto_record_num(auparse_state_t *au, unsigned int num)
18871886
{
18881887
rnode *r;
18891888

18901889
r = aup_list_get_cur(au->le);
1891-
if (r && r->item == num && interpretation_list_cnt()) {
1890+
if (r && r->item == num && interpretation_list_cnt(au)) {
18921891
// If we are on the first record and the list has previously
18931892
// been loaded, just pull cursor back and avoid loading the
18941893
// interpretation list.
@@ -1897,14 +1896,15 @@ int auparse_goto_record_num(const auparse_state_t *au, unsigned int num)
18971896
}
18981897

18991898
/* Check if a request is out of range */
1900-
free_interpretation_list();
1899+
free_interpretation_list(au);
1900+
19011901
// Its OK if au->le == NULL because get_cnt handles it
19021902
if (num >= aup_list_get_cnt(au->le))
19031903
return 0;
19041904

19051905
r = aup_list_goto_rec(au->le, num);
19061906
if (r != NULL) {
1907-
load_interpretation_list(r->interp);
1907+
load_interpretation_list(au, r->interp);
19081908
aup_list_first_field(au->le);
19091909
return 1;
19101910
} else
@@ -2065,7 +2065,7 @@ const char *auparse_find_field(auparse_state_t *au, const char *name)
20652065
}
20662066

20672067
/* Increment 1 location and then scan for next field */
2068-
const char *auparse_find_field_next(const auparse_state_t *au)
2068+
const char *auparse_find_field_next(auparse_state_t *au)
20692069
{
20702070
if (au->le == NULL)
20712071
return NULL;
@@ -2089,8 +2089,8 @@ const char *auparse_find_field_next(const auparse_state_t *au)
20892089
r = aup_list_next(au->le);
20902090
if (r) {
20912091
aup_list_first_field(au->le);
2092-
free_interpretation_list();
2093-
load_interpretation_list(r->interp);
2092+
free_interpretation_list(au);
2093+
load_interpretation_list(au, r->interp);
20942094
}
20952095
}
20962096
}
@@ -2193,7 +2193,7 @@ const char *auparse_interpret_field(auparse_state_t *au)
21932193
rnode *r = aup_list_get_cur(au->le);
21942194
if (r) {
21952195
r->cwd = NULL;
2196-
return nvlist_interp_cur_val(r, au->escape_mode);
2196+
return nvlist_interp_cur_val(au, r);
21972197
}
21982198
}
21992199
return NULL;
@@ -2213,7 +2213,7 @@ const char *auparse_interpret_realpath(const auparse_state_t *au)
22132213

22142214
// Tell it to make a realpath
22152215
r->cwd = au->le->cwd;
2216-
return nvlist_interp_cur_val(r, au->escape_mode);
2216+
return nvlist_interp_cur_val((auparse_state_t *)au, r);
22172217
}
22182218
}
22192219
return NULL;
@@ -2233,7 +2233,7 @@ static const char *auparse_interpret_sock_parts(auparse_state_t *au,
22332233
if (nvlist_get_cur_type(r) != AUPARSE_TYPE_SOCKADDR)
22342234
return NULL;
22352235
// Get interpretation
2236-
const char *val = nvlist_interp_cur_val(r, au->escape_mode);
2236+
const char *val=nvlist_interp_cur_val((auparse_state_t *)au,r);
22372237
if (val == NULL)
22382238
return NULL;
22392239
// make a copy since we modify it

‎auparse/auparse.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@ void auparse_add_callback(auparse_state_t *au, auparse_callback_ptr callback,
6868
void *user_data, user_destroy user_destroy_func);
6969
void auparse_set_escape_mode(auparse_state_t *au, auparse_esc_t mode);
7070
int auparse_reset(auparse_state_t *au);
71-
char *auparse_metrics(const auparse_state_t *au) __attr_dealloc_free;
71+
char *auparse_metrics(const auparse_state_t *au)
72+
__attribute_malloc__ __attr_dealloc_free;
7273

7374
/* Functions that are part of the search interface */
7475
int ausearch_add_expression(auparse_state_t *au, const char *expression,
@@ -145,7 +146,7 @@ unsigned int auparse_get_num_records(const auparse_state_t *au);
145146
int auparse_first_record(auparse_state_t *au);
146147
int auparse_next_record(auparse_state_t *au);
147148
unsigned int auparse_get_record_num(const auparse_state_t *au);
148-
int auparse_goto_record_num(const auparse_state_t *au, unsigned int num);
149+
int auparse_goto_record_num(auparse_state_t *au, unsigned int num);
149150

150151
/* Accessors to record data */
151152
int auparse_get_type(const auparse_state_t *au);
@@ -158,7 +159,7 @@ unsigned int auparse_get_num_fields(const auparse_state_t *au);
158159
const char *auparse_get_record_text(const auparse_state_t *au);
159160
const char *auparse_get_record_interpretations(const auparse_state_t *au);
160161
const char *auparse_find_field(auparse_state_t *au, const char *name);
161-
const char *auparse_find_field_next(const auparse_state_t *au);
162+
const char *auparse_find_field_next(auparse_state_t *au);
162163
unsigned int auparse_get_field_num(const auparse_state_t *au);
163164
int auparse_goto_field_num(const auparse_state_t *au, unsigned int num);
164165

‎auparse/expression.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1018,7 +1018,7 @@ eval_interpreted_value(const auparse_state_t *au, rnode *record,
10181018
if (nvlist_find_name(&record->nv, expr->v.p.field.name) == 0)
10191019
return NULL;
10201020
*free_it = 0;
1021-
res = nvlist_interp_cur_val(record, au->escape_mode);
1021+
res = nvlist_interp_cur_val((auparse_state_t *)au, record);
10221022
if (res == NULL)
10231023
res = nvlist_get_cur_val(&record->nv);
10241024
return (char *)res;

‎auparse/internal.h‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* internal.h --
2-
* Copyright 2006-07,2013-17 Red Hat Inc., Durham, North Carolina.
2+
* Copyright 2006-07,2013-17,2025 Red Hat Inc.
33
* All Rights Reserved.
44
*
55
* This library is free software; you can redistribute it and/or
@@ -28,6 +28,8 @@
2828
#include "data_buf.h"
2929
#include "normalize-llist.h"
3030
#include "dso.h"
31+
#include "nvlist.h"
32+
#include "lru.h"
3133
#include <stdio.h>
3234

3335
/* This is what state the parser is in */
@@ -140,6 +142,7 @@ typedef struct data
140142

141143
struct opaque
142144
{
145+
nvlist interpretations; // Per-parser interpretations list
143146
ausource_t source; // Source type
144147
char **source_list; // Array of buffers, or array of
145148
// file names
@@ -178,6 +181,10 @@ struct opaque
178181
debug_message_t debug_message; // Whether or not messages are debug or not
179182
const char *tmp_translation; // Pointer to manage mem for field translation
180183
normalize_data norm_data;
184+
Queue *uid_cache; // per-parser UID cache
185+
int uid_cache_created;
186+
Queue *gid_cache; // per-parser GID cache
187+
int gid_cache_created;
181188
};
182189

183190
AUDIT_HIDDEN_START

0 commit comments

Comments
 (0)